Siemens Sicam Gridedge vulnerabilities

CVE-2022-30230 [CRITICAL] CWE-306 CVE-2022-30230: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affecte A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to create a new user with administrative permissions.

CVE-2022-30228 [MEDIUM] CWE-346 CVE-2022-30228: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affecte A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected software does not apply cross-origin resource sharing (CORS) restrictions for critical operations. In case an attacker tricks a legitimate user into accessing a special resource a malicious request could be executed.

CVE-2022-30229 [MEDIUM] CWE-306 CVE-2022-30229: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affecte A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application does not require authenticated access for privileged functions. This could allow an unauthenticated attacker to change data of a user, such as credentials, in case that user's id is known.

CVE-2022-34464 [MEDIUM] CWE-552 CVE-2022-34464: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.7.3). The affecte A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.7.3). The affected application uses an improperly protected file to import SSH keys. This could allow attackers with access to the filesystem of the host on which SICAM GridEdge runs to inject a custom SSH key to that file.

CVE-2022-30231 [MEDIUM] CWE-402 CVE-2022-30231: A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affecte A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon request. This could allow an authenticated user to retrieve another user's password hash.